Object Modification Vulnerability in ApostropheCMS Import-Export Module

CVE-2026-113662

What is CVE-2026-113662?

ApostropheCMS, a popular open-source Node.js content management system, is impacted by a vulnerability in its Import-Export module prior to version 3.7.0. This vulnerability allows an authenticated user with import access to manipulate an update-key value, potentially causing the import query to match a document that the user has generic edit permissions to modify. While the existing permissions filter does somewhat limit access, it does not prevent the issue from enabling unintended alterations to documents. This vulnerability underscores the importance of upgrading to version 3.7.0 or later, which addresses the issue and ensures more robust controls over content modification.

References